Skip to content

Add a release-time safety check for silently corrupted versioned install scripts#50

Draft
jnasbyupgrade wants to merge 1 commit into
masterfrom
release-safety-check
Draft

Add a release-time safety check for silently corrupted versioned install scripts#50
jnasbyupgrade wants to merge 1 commit into
masterfrom
release-safety-check

Conversation

@jnasbyupgrade

Copy link
Copy Markdown
Contributor

sql.mk regenerates the current version's sql/cat_tools--.sql.in from sql/cat_tools.sql.in whenever default_version and that source file change, via the $(EXTENSION_VERSION_FILES:.sql=.sql.in) rule (cp $< $@). If default_version is ever left pointing at an already-tagged real version rather than the stable pseudo-version, a later source edit silently overwrites — and corrupts — that released version's committed install file. Add a new step 1 to RELEASE.md, before the version-bump steps, that has the release manager compare each committed versioned install script's last-touching commit against the git tag for that version, flagging any file touched after its own release as a red flag worth investigating, while noting that a late touch-date can also be a legitimate backfill rather than corruption. Renumber the remaining steps (2-7) and their cross-references accordingly.

Checked cat_tools' own history while writing this: default_version has in fact never been the literal string stable in cat_tools.control's git history (it's a real version right now, 0.3.0) — the stable pseudo-version scheme described elsewhere in this doc is still aspirational, not yet implemented. That's out of scope here; this PR is only the safety-check checklist addition. Also checked both currently-tagged versions (0.2.2, 0.2.3) against this new check: both are clean, no drift found.

…all scripts

sql.mk regenerates the current version's sql/cat_tools--<version>.sql.in from
sql/cat_tools.sql.in whenever default_version and that source file change, via
the $(EXTENSION_VERSION_FILES:.sql=.sql.in) rule (`cp $< $@`). If default_version
is ever left pointing at an already-tagged real version rather than the `stable`
pseudo-version, a later source edit silently overwrites — and corrupts — that
released version's committed install file. Add a new step 1 to RELEASE.md,
before the version-bump steps, that has the release manager compare each
committed versioned install script's last-touching commit against the git tag
for that version, flagging any file touched after its own release as a red
flag worth investigating, while noting that a late touch-date can also be a
legitimate backfill rather than corruption. Renumber the remaining steps (2-7)
and their cross-references accordingly.

Checked cat_tools' own history while writing this: default_version has in fact
never been the literal string 'stable' in cat_tools.control's git history (it
is a real version right now, 0.3.0) — the stable pseudo-version scheme described
elsewhere in this doc is still aspirational, not yet implemented. That's outside
this change's scope. Also checked both currently-tagged versions (0.2.2, 0.2.3)
against this new check: both are clean, no drift found.
@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 13543e03-321f-4b06-b5b2-c14847cdac2b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release-safety-check

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant